Keeping current logged user.

[Stas Melnychenko]

Hello.
I write my first web application, and I use JSF, Spring, Hibernate.
At first, I wrote authorization/registration part.
I have two pages, mainpage.jsp contain login form, and registration.jsp contain registering form.
And this is my beans:
<bean id="SessionFactory" class="org.springframework.orm.hibernate4.LocalSessionFactoryBean"> <property name="configLocation" value="hibernate.cfg.xml" /> </bean> <bean id="UserDao" class="project.dao.UserDaoImpl"> <constructor-arg> <value>project.model.User</value> </constructor-arg> <property name="sessionFactory" ref="SessionFactory" /> </bean> <bean id="UserService" class="project.service.UserServiceImpl"> <property name="userDao" ref="UserDao" /> </bean> <bean id="UserLogin" class="project.jsf.UserLogin" scope="request"> <property name="userService" ref="UserService" /> <!-- <aop:scoped-proxy/> --> </bean> <bean id="UserRegister" class="project.jsf.UserRegister" scope="request"> <property name="userService" ref="UserService" /> <!-- <aop:scoped-proxy/> --> </bean>

So, my backbeans UserLogin and UserInfo are request-scoped, because its contain error messages like "Password is incorrect" or "User UserName already exists". And now I need one more session-scoped bean for containing current logged user. But I an not sure, HOW, so tell me please, am I wright:
I want to add new bean UserInfo and change existing bean UserLogin:

<bean id="UserLogin" class="project.jsf.UserLogin" scope="request"> <property name="userInfo" ref="UserInfo" /> <!-- <aop:scoped-proxy/> --> </bean> <bean id="UserInfo" class="project.jsf.UserInfo" scope="session"> <property name="userService" ref="UserService" /> <aop:scoped-proxy/> </bean>

and method of UserLogin:

    
    private String login;
    private String password;
    private String loginMessage;

    private User user;

    private UserService userService;

public void loginUser() {
	if (login.length() == 0) {
	    loginMessage = "Login cannot be empty";
	    return;
	} else if (!userService.isUserExists(login)) {
	    loginMessage = "Username is incorrect";
	    return;
	} else if (!userService.isPasswordCorrect(login, password)) {
	    loginMessage = "Password is incorrect";
	    return;
	}
	user = userService.login(login, password);
	loginMessage = "Welcome, " + login;
    }

I change to

public void loginUser() {
   private UserInfo userInfo
             ...
	userInfo.login(login, password);
	loginMessage = "Welcome, " + login;
    }

and UserInfo will contain

private User user;
user = userService.login(login, password);

Am I on wright way or this is bad shot?

Another method: leave all beans in current stand, and just get current http session in login procedure and save user in it.

So what way is better?